diff options
| author | Markus Holtermann <info@markusholtermann.eu> | 2015-03-31 15:47:06 +0200 |
|---|---|---|
| committer | Markus Holtermann <info@markusholtermann.eu> | 2015-04-11 21:12:09 +0200 |
| commit | 3862826fedc99378279b85e602079b53593ae129 (patch) | |
| tree | b7d0e8ad1bdbf55a1013f383cc9a3161454f59ec /tests/admin_docs/tests.py | |
| parent | 774d09a7dd62a5a7c90343e08ea38bcb065ecf94 (diff) | |
[1.8.x] Fixed #24625 -- Prevented arbitrary file inclusion in admindocs
Thanks Tim Graham for the review.
Backport of 09595b4fc67ac4c94ed4e0d4c69acc1e4a748c81 from master
Diffstat (limited to 'tests/admin_docs/tests.py')
| -rw-r--r-- | tests/admin_docs/tests.py | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/tests/admin_docs/tests.py b/tests/admin_docs/tests.py index fe668e2119..94054f9437 100644 --- a/tests/admin_docs/tests.py +++ b/tests/admin_docs/tests.py @@ -280,6 +280,12 @@ class TestModelDetailView(AdminDocsTestCase): "all related %s objects" % (link % ("admin_docs.group", "admin_docs.Group")) ) + # "raw" and "include" directives are disabled + self.assertContains(self.response, '<p>"raw" directive disabled.</p>',) + self.assertContains(self.response, '.. raw:: html\n :file: admin_docs/evilfile.txt') + self.assertContains(self.response, '<p>"include" directive disabled.</p>',) + self.assertContains(self.response, '.. include:: admin_docs/evilfile.txt') + def test_model_with_many_to_one(self): link = '<a class="reference external" href="/admindocs/models/%s/">%s</a>' response = self.client.get( |